Re: Files with colons under Cygwin

[Johannes Sixt <j.sixt@viscovery.net>]

Dmitry Potapov schrieb:
> Subject: [PATCH] correct verify_path for Windows
> 
> Colon and backslash in names may be used on Windows to overwrite files
> outside of the working directory.
> 
> Signed-off-by: Dmitry Potapov <dpotapov@gmail.com>
> ---
>  read-cache.c |   10 ++++++++++
>  1 files changed, 10 insertions(+), 0 deletions(-)
> 
> diff --git a/read-cache.c b/read-cache.c
> index 901064b..972592e 100644
> --- a/read-cache.c
> +++ b/read-cache.c
> @@ -701,6 +701,16 @@ inside:
>  			}
>  			return 0;
>  		}
> +#if defined(_WIN32) || defined(__CYGWIN__)
> +		/*
> +		 * There is a bunch of other characters that are not allowed
> +		 * in Win32 API, but the following two create a security hole
> +		 * by allowing to overwrite files outside of the working tree,
> +		 * therefore they are explicitly prohibited.
> +		 */
> +		else if (c == ':' || c == '\\')
> +			return 0;
> +#endif
>  		c = *path++;
>  	}
>  }

IIUC, verify_path() checks paths that were found in the database or the
index. As such, it checks for the integrity of the database. And paths
with backslashes or colons certainly do not violate the database integrity.

More precisely, the exchange of path names between the index and tree
objects (both directions) should not do this new check, nor if a path is
added to the index. The check is only meaningful[*] when a path is read
from the index or a tree object and "applied" to the working directory.
Unfortunately, I think there are lots of places where this happens.

[*] I say "meaningful" and not "necessary" because the situation is just
like when you grab some random SoftwarePackage.tar.gz, and run ./configure
without looking first what it is going to do.

-- Hannes